Given a Scenario, Identify the Security Considerations and Risks, and Leverage the Appropriate Security Capabilities to Design a Secure Portal Architecture Including Access by Both Internal and External Users. TECHNICAL-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A portal allows external users to view and edit their own profile information. The architect wants to ensure that users cannot modify fields that are system-managed, such as the account owner. Which configuration should be used?

   • AUse a sharing rule to restrict access to system-managed fields.
   • BUse a custom Apex trigger to revert changes to system-managed fields.
   • CUse a validation rule to prevent changes to system-managed fields.
   • DSet field-level security to make system-managed fields read-only for the external user profile.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which regulation specifically governs the processing of personal data of individuals in the European Union?

   • ASOX
   • BHIPAA
   • CGDPR
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A portal is being designed for a financial services firm. The portal will be accessed by internal advisors and external clients. The firm has a strict security policy that requires session timeouts, IP restrictions, and protection against session hijacking. Which set of configurations should the architect prioritize?

   • AUse a custom login flow that checks the user's browser fingerprint and blocks suspicious sessions.
   • BConfigure session timeout settings, set login IP ranges for external users, and enable 'Secure and SameSite' cookies.
   • CSet login IP ranges for all users, including internal advisors, and use a short session timeout of 5 minutes.
   • DDisable session timeout to avoid user frustration and rely on IP restrictions.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which security control is commonly used to prevent cross-site request forgery (CSRF) attacks?

   • APassword complexity rules
   • BSession timeout
   • CIP restrictions
   • DAnti-CSRF tokens
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A global company is deploying a partner portal that will collect personal data from users in the European Union. The portal must comply with GDPR. Which set of features should the architect include?

   • AEncrypt all data at rest and in transit, but do not provide any user-facing privacy controls.
   • BProvide a consent checkbox during self-registration, implement a data retention policy, and ensure that users can request data deletion.
   • CUse a third-party consent management platform and store consent records in Salesforce, but do not implement data deletion.
   • DStore all personal data in a custom object with OWD Private and do not allow users to view or edit their data.
   Reveal Solution Discussion Select an answer first